1. A Proposed Navigation Message Authentication Implementation for Civil GPS Anti-Spoofing
Kyle Wesson, Mark Rothlisberger, and Todd Humphreys
Presentation at ION 2011| September 23, 2011

2. Our Recent Work

3. Outline Introduction: Civil GPS Anti-Spoofing
Security-Enhanced GNSS Signal Authentication
Proposed GPS Cryptographic Signal Authentication Strategy
Authentication Performance and Experimental Results
Conclusions

4. Types of Civil Anti-Spoofing
Cryptographic
Navigation Message Authentication
Spreading Code Authentication
Dual-Receiver Correlation
Non-Cryptographic
Multi-Antenna Defense
Vestigial Signal Defense (VSD)
Why navigation message authentication?
Offers significant protection against spoofing relative to additional cost and bulk required for implementation
Practical and surprisingly effective
Suggested by Logan Scott in 2003
Why cryptographic?
Does not require additional hardware at receiver
Can distinguish authentic from spoofed signal

5. Part I: Security-Enhanced GNSS Signal Authentication

6. Security-Enhanced GNSS Signal Model
Security code :
Generalization of binary modulating sequence
Either fully encrypted or contains periodic authentication codes
Unpredictable to would be spoofer

7. Attacking Security-Enhanced GNSS Signals
Meaconing: Spoofer records and re-broadcasts entire block of RF spectrum containing ensemble of GNSS signals
Security Code Estimation and Replay (SCER) Attack: Spoofer estimates unpredictable security code chips from authentic signals on-the-fly

8. What does it take to authenticate a GNSS Signal?
Code Timing Authentication
Code Origin Authentication

9. Operational Definition: GNSS Signal Authentication
GNSS signal is declared authentic if:
Logical output S has remained low
Logical output H1 has remained low, and
Output PD has remained above an acceptable threshold

10. Part II: Proposed GPS Cryptographic Signal Authentication Strategy

11. What qualities should cryptographic civil GPS signal authentication have?
Effective: they make it difficult for a spoofer to carry off a successful spoofing attack
Practical: they are likely to be implemented and adopted by the GPS community

12. A strategy that meets these requirements:
Navigation Message Authentication (NMA):
Forms by making the navigation message periodically unpredictable
Applies public-key cryptographic digital signature and verification techniques

13. Public-Key Digital Signatures for GPS
Digital signatures allow messages to be signed and then verified:
Elliptic Curve Digital Signature Algorithm (ECDSA) is most appropriate for GPS:
It’s standardized
It’s efficient to verify signatures
It has a short signature length (but not too short!)

14. Where do we put the digital signature?
Civil Navigation (CNAV) Message:
Flexible and extensible message format
Packet-like structure:
Every 12 seconds, broadcast 300-bit packet
Message type identification field can identify up to 64 messages of which only 15 are defined

15. CNAV Message

16. CNAV ECDSA Message

17. Signing the CNAV Message
Delivers ECDSA signature every five minutes per channel
Delivers 476 unpredictable navigation message bits
Offset scheme could lower time-between-authentications

18. Part III: Authentication Performance and Experimental Results

19. Hypothesis Testing on Security Code

20. Challenging Spoofing Attack Scenario
Challenging attack scenario from receiver’s perspective:
Spoofer has 3 dB carrier-to-noise ratio advantage over the receiver
Received spoofed signals are 1.1 times stronger than the received authentic signals
Spoofer has introduce a timing error of 1 microsecond in the receiver
False alarm probability for SCER detector is

21. Probability of Detection under Scenario

22. Conclusions GNSS signal authentication is probabilistic
Navigation message authentication is practical and surprisingly effective for civil GPS anti-spoofing
CNAV message can be extended to broadcast digital signatures
Visit us on the web: